IronPort: Content Filter with AND condition, not OR

[David Rahmn]

Hi!

I have an IronPort 370 and would like to create a content filter that sets all emails in quarantine if it has a specific work in the Subject field.

So i went to Incoming conent filter and added that Condition and applied it to a policy. 

It works fine! The emails end up in quarantine if that word is in the subject, The problem is now that I need to do an exception to that rule.

So I want to have a rule with the condition: IF Subject Header Contains this Word  AND NOT From these email adresses THEN put in quarantine.

Is there a way to solve this? When I put in another condition in the content filter they are treated as OR which would make all emails to be put in quarantine if it's not from those specific email adresses.

Any ideas ?

[Jernej Vodopivec · Accepted solution]

Hi David,

yes, you can achieve this by setting apply rule to "Only if all conditions match" at "Edit Incoming Content Filter" page.

If one or more conditions match Only if all conditions match

[David Rahmn]

I thought I was blind but I found it eventually, it's only availble when you add the second condition!

Thanks Jernej!!

[Jernej Vodopivec]

You're welcome :)